Cargo.toml

@@ -21,13 +21,17 @@ egui_extras = { version = "0.32", features = ["image"] }
 egui-notify = "0.20"
 egui-winit = "0.32"
 egui-wgpu = { version = "0.32", features = ["winit"] }
+fxprof-processed-profile = "0.8"
 fixed = { version = "1.28", features = ["num-traits"] }
 gilrs = { version = "0.11", features = ["serde-serialize"] }
+gimli = "0.32"
 hex = "0.4"
 image = { version = "0.25", default-features = false, features = ["png"] }
 itertools = "0.14"
+normpath = "1"
 num-derive = "0.4"
 num-traits = "0.2"
+object = "0.37"
 oneshot = "0.1"
 pollster = "0.4"
 rand = "0.9"
@@ -41,6 +45,7 @@ tokio = { version = "1", features = ["io-util", "macros", "net", "rt", "sync", "
 tracing = { version = "0.1", features = ["release_max_level_info"] }
 tracing-subscriber = { version = "0.3", features = ["env-filter"] }
 wgpu = "25"
+wholesym = "0.8"
 winit = { version = "0.30", features = ["serde"] }
 
 [target.'cfg(windows)'.dependencies]

build.rs

@@ -23,7 +23,9 @@ fn main() -> Result<(), Box<dyn Error>> {
         .define("VB_LITTLE_ENDIAN", None)
         .define("VB_SIGNED_PROPAGATE", None)
         .define("VB_DIV_GENERIC", None)
+        .define("VB_DIRECT_EXCEPTION", "on_exception")
         .define("VB_DIRECT_EXECUTE", "on_execute")
+        .define("VB_DIRECT_FETCH", "on_fetch")
         .define("VB_DIRECT_FRAME", "on_frame")
         .define("VB_DIRECT_READ", "on_read")
         .define("VB_DIRECT_WRITE", "on_write")

src/app.rs

@@ -24,8 +24,8 @@ use crate::{
     persistence::Persistence,
     window::{
         AboutWindow, AppWindow, BgMapWindow, CharacterDataWindow, FrameBufferWindow, GameWindow,
-        GdbServerWindow, HotkeysWindow, InputWindow, ObjectWindow, RegisterWindow, TerminalWindow,
-        WorldWindow,
+        GdbServerWindow, HotkeysWindow, InputWindow, ObjectWindow, ProfileWindow, RegisterWindow,
+        TerminalWindow, WorldWindow,
     },
 };
 
@@ -54,6 +54,7 @@ pub struct Application {
     viewports: HashMap<ViewportId, Viewport>,
     focused: Option<ViewportId>,
     init_debug_port: Option<u16>,
+    init_profiling: bool,
 }
 
 impl Application {
@@ -61,6 +62,7 @@ impl Application {
         client: EmulatorClient,
         proxy: EventLoopProxy<UserEvent>,
         debug_port: Option<u16>,
+        profiling: bool,
     ) -> Self {
         let wgpu = WgpuState::new();
         let icon = load_icon().ok().map(Arc::new);
@@ -89,6 +91,7 @@ impl Application {
             viewports: HashMap::new(),
             focused: None,
             init_debug_port: debug_port,
+            init_profiling: profiling,
         }
     }
 
@@ -121,6 +124,11 @@ impl ApplicationHandler<UserEvent> for Application {
             SimId::Player1,
         );
         self.open(event_loop, Box::new(app));
+        if self.init_profiling {
+            let mut profiler = ProfileWindow::new(SimId::Player1, self.client.clone());
+            profiler.launch();
+            self.open(event_loop, Box::new(profiler));
+        }
     }
 
     fn window_event(
@@ -247,6 +255,10 @@ impl ApplicationHandler<UserEvent> for Application {
                 let terminal = TerminalWindow::new(sim_id, &self.client);
                 self.open(event_loop, Box::new(terminal));
             }
+            UserEvent::OpenProfiler(sim_id) => {
+                let profile = ProfileWindow::new(sim_id, self.client.clone());
+                self.open(event_loop, Box::new(profile));
+            }
             UserEvent::OpenDebugger(sim_id) => {
                 let debugger =
                     GdbServerWindow::new(sim_id, self.client.clone(), self.proxy.clone());
@@ -521,6 +533,7 @@ pub enum UserEvent {
     OpenFrameBuffers(SimId),
     OpenRegisters(SimId),
     OpenTerminal(SimId),
+    OpenProfiler(SimId),
     OpenDebugger(SimId),
     OpenInput,
     OpenHotkeys,

src/emulator.rs

@@ -18,15 +18,20 @@ use tracing::{error, warn};
 
 use crate::{
     audio::Audio,
-    emulator::cart::Cart,
     graphics::TextureSink,
     memory::{MemoryRange, MemoryRegion},
 };
+use cart::Cart;
+pub use game_info::GameInfo;
+pub use inline_stack_map::InlineStack;
+use inline_stack_map::InlineStackMap;
 use shrooms_vb_core::{EXPECTED_FRAME_SIZE, Sim, StopReason};
-pub use shrooms_vb_core::{VBKey, VBRegister, VBWatchpointType};
+pub use shrooms_vb_core::{SimEvent, VBKey, VBRegister, VBWatchpointType};
 
 mod address_set;
 mod cart;
+mod game_info;
+mod inline_stack_map;
 mod shrooms_vb_core;
 
 #[derive(PartialEq, Eq, Hash, Clone, Copy, Debug)]
@@ -137,6 +142,7 @@ pub struct Emulator {
     state: Arc<Atomic<EmulatorState>>,
     audio_on: Arc<[AtomicBool; 2]>,
     linked: Arc<AtomicBool>,
+    profilers: [Option<ProfileSender>; 2],
     renderers: HashMap<SimId, TextureSink>,
     messages: HashMap<SimId, mpsc::Sender<Toast>>,
     debuggers: HashMap<SimId, DebugInfo>,
@@ -164,6 +170,7 @@ impl Emulator {
             state,
             audio_on,
             linked,
+            profilers: [None, None],
             renderers: HashMap::new(),
             messages: HashMap::new(),
             debuggers: HashMap::new(),
@@ -218,6 +225,22 @@ impl Emulator {
             self.carts[index] = Some(cart);
             self.sim_state[index].store(SimState::Ready, Ordering::Release);
         }
+        let mut profiling = false;
+        if let Some(profiler) = self.profilers[sim_id.to_index()].as_ref()
+            && let Some(cart) = self.carts[index].as_ref()
+            && profiler
+                .send(ProfileEvent::Start {
+                    info: cart.info.clone(),
+                })
+                .is_ok()
+        {
+            sim.monitor_events(true, cart.info.inline_stack_map().clone());
+            profiling = true;
+        }
+        if !profiling {
+            sim.monitor_events(false, InlineStackMap::empty());
+        }
+
         if self.sim_state[index].load(Ordering::Acquire) == SimState::Ready {
             self.resume_sims();
         }
@@ -315,6 +338,11 @@ impl Emulator {
         Ok(())
     }
 
+    fn start_profiling(&mut self, sim_id: SimId, sender: ProfileSender) -> Result<()> {
+        self.profilers[sim_id.to_index()] = Some(sender);
+        self.reset_sim(sim_id, None)
+    }
+
     fn start_debugging(&mut self, sim_id: SimId, sender: DebugSender) {
         if self.sim_state[sim_id.to_index()].load(Ordering::Acquire) != SimState::Ready {
             // Can't debug unless a game is connected
@@ -438,12 +466,32 @@ impl Emulator {
         let p1_running = running && p1_state == SimState::Ready;
         let p2_running = running && p2_state == SimState::Ready;
         let mut idle = !p1_running && !p2_running;
-        if p1_running && p2_running {
-            Sim::emulate_many(&mut self.sims);
-        } else if p1_running {
-            self.sims[SimId::Player1.to_index()].emulate();
-        } else if p2_running {
-            self.sims[SimId::Player2.to_index()].emulate();
+
+        let cycles = self.emulate(p1_running, p2_running);
+
+        // if we're profiling, track events
+        for ((sim, profiler), running) in self
+            .sims
+            .iter_mut()
+            .zip(self.profilers.iter_mut())
+            .zip([p1_running, p2_running])
+        {
+            if !running {
+                continue;
+            }
+            if let Some(p) = profiler {
+                let (event, inline_stack) = sim.take_profiler_updates();
+                if p.send(ProfileEvent::Update {
+                    cycles,
+                    event,
+                    inline_stack,
+                })
+                .is_err()
+                {
+                    sim.monitor_events(false, InlineStackMap::empty());
+                    *profiler = None;
+                }
+            }
         }
 
         if state == EmulatorState::Stepping {
@@ -470,7 +518,7 @@ impl Emulator {
                 let Some(sim) = self.sims.get_mut(sim_id.to_index()) else {
                     continue;
                 };
-                if let Some(reason) = sim.stop_reason() {
+                if let Some(reason) = sim.take_stop_reason() {
                     let stop_reason = match reason {
                         StopReason::Stepped => DebugStopReason::Trace,
                         StopReason::Watchpoint(watch, address) => {
@@ -529,6 +577,19 @@ impl Emulator {
         idle
     }
 
+    fn emulate(&mut self, p1_running: bool, p2_running: bool) -> u32 {
+        const MAX_CYCLES: u32 = 20_000_000;
+        let mut cycles = MAX_CYCLES;
+        if p1_running && p2_running {
+            Sim::emulate_many(&mut self.sims, &mut cycles);
+        } else if p1_running {
+            self.sims[SimId::Player1.to_index()].emulate(&mut cycles);
+        } else if p2_running {
+            self.sims[SimId::Player2.to_index()].emulate(&mut cycles);
+        }
+        MAX_CYCLES - cycles
+    }
+
     fn handle_command(&mut self, command: EmulatorCommand) {
         match command {
             EmulatorCommand::ConnectToSim(sim_id, renderer, messages) => {
@@ -572,6 +633,11 @@ impl Emulator {
                     self.report_error(SimId::Player1, format!("Error setting speed: {error}"));
                 }
             }
+            EmulatorCommand::StartProfiling(sim_id, profiler) => {
+                if let Err(error) = self.start_profiling(sim_id, profiler) {
+                    self.report_error(SimId::Player1, format!("Error enaling profiler: {error}"));
+                }
+            }
             EmulatorCommand::StartDebugging(sim_id, debugger) => {
                 self.start_debugging(sim_id, debugger);
             }
@@ -709,6 +775,7 @@ pub enum EmulatorCommand {
     Resume,
     FrameAdvance,
     SetSpeed(f64),
+    StartProfiling(SimId, ProfileSender),
     StartDebugging(SimId, DebugSender),
     StopDebugging(SimId),
     DebugInterrupt(SimId),
@@ -750,6 +817,7 @@ pub enum EmulatorState {
     Debugging,
 }
 
+type ProfileSender = tokio::sync::mpsc::UnboundedSender<ProfileEvent>;
 type DebugSender = tokio::sync::mpsc::UnboundedSender<DebugEvent>;
 
 #[derive(Clone, Copy, Debug, PartialEq, Eq)]
@@ -773,6 +841,17 @@ pub enum DebugEvent {
     Stopped(DebugStopReason),
 }
 
+pub enum ProfileEvent {
+    Start {
+        info: Arc<GameInfo>,
+    },
+    Update {
+        cycles: u32,
+        event: Option<SimEvent>,
+        inline_stack: Option<InlineStack>,
+    },
+}
+
 #[derive(Clone)]
 pub struct EmulatorClient {
     queue: mpsc::Sender<EmulatorCommand>,

src/emulator/cart.rs

@@ -4,20 +4,24 @@ use std::{
     fs::{self, File},
     io::{Read, Seek as _, SeekFrom, Write as _},
     path::{Path, PathBuf},
+    sync::Arc,
 };
 
-use crate::emulator::SimId;
+use crate::emulator::{SimId, game_info::GameInfo};
 
 pub struct Cart {
     pub file_path: PathBuf,
     pub rom: Vec<u8>,
     sram_file: File,
     pub sram: Vec<u8>,
+    pub info: Arc<GameInfo>,
 }
 
 impl Cart {
     pub fn load(file_path: &Path, sim_id: SimId) -> Result<Self> {
         let rom = fs::read(file_path)?;
+        let (rom, info) =
+            try_parse_elf(file_path, &rom).unwrap_or_else(|| (rom, GameInfo::empty(file_path)));
 
         let mut sram_file = File::options()
             .read(true)
@@ -45,6 +49,7 @@ impl Cart {
             rom,
             sram_file,
             sram,
+            info: Arc::new(info),
         })
     }
 
@@ -55,6 +60,44 @@ impl Cart {
     }
 }
 
+fn try_parse_elf(file_path: &Path, data: &[u8]) -> Option<(Vec<u8>, GameInfo)> {
+    use object::read::elf::FileHeader;
+    let program = match object::FileKind::parse(data).ok()? {
+        object::FileKind::Elf32 => {
+            let header = object::elf::FileHeader32::parse(data).ok()?;
+            parse_elf_program(header, data)?
+        }
+        object::FileKind::Elf64 => {
+            let header = object::elf::FileHeader64::parse(data).ok()?;
+            parse_elf_program(header, data)?
+        }
+        _ => return None,
+    };
+    let info = GameInfo::new(file_path, data).unwrap_or_else(|_| GameInfo::empty(file_path));
+    Some((program, info))
+}
+
+fn parse_elf_program<Elf: object::read::elf::FileHeader<Endian = object::Endianness>>(
+    header: &Elf,
+    data: &[u8],
+) -> Option<Vec<u8>> {
+    use object::read::elf::ProgramHeader;
+    let endian = header.endian().ok()?;
+    let mut bytes = vec![];
+    let mut pstart = None;
+    for phdr in header.program_headers(endian, data).ok()? {
+        if phdr.p_filesz(endian).into() == 0 {
+            continue;
+        }
+        let start = pstart.unwrap_or(phdr.p_paddr(endian).into());
+        pstart = Some(start);
+        bytes.resize((phdr.p_paddr(endian).into() - start) as usize, 0);
+        let data = phdr.data(endian, data).ok()?;
+        bytes.extend_from_slice(data);
+    }
+    Some(bytes)
+}
+
 fn sram_path(file_path: &Path, sim_id: SimId) -> PathBuf {
     match sim_id {
         SimId::Player1 => file_path.with_extension("p1.sram"),

src/emulator/game_info.rs

@@ -0,0 +1,201 @@
+use std::{borrow::Cow, path::Path, sync::Arc};
+
+use anyhow::{Result, bail};
+use fxprof_processed_profile::{LibraryInfo, Symbol, SymbolTable, debugid::DebugId};
+use object::{Object, ObjectSection, ObjectSymbol};
+use wholesym::samply_symbols::{DebugIdExt, demangle_any};
+
+use crate::emulator::inline_stack_map::{InlineStackMap, InlineStackMapBuilder};
+
+#[derive(Debug)]
+pub struct GameInfo {
+    library_info: LibraryInfo,
+    inline_stack_map: InlineStackMap,
+}
+
+impl GameInfo {
+    pub fn new(file_path: &Path, input: &[u8]) -> Result<Self> {
+        let file = object::File::parse(input)?;
+
+        let (name, path) = name_and_path(file_path);
+        let debug_id = file
+            .build_id()?
+            .map(|id| DebugId::from_identifier(id, true))
+            .unwrap_or_default();
+        let code_id = file.build_id()?.map(hex::encode);
+        let mut symbols = vec![];
+        for sym in file.symbols() {
+            symbols.push(Symbol {
+                address: sym.address() as u32,
+                size: Some(sym.size() as u32),
+                name: demangle_any(sym.name()?),
+            });
+        }
+
+        let inline_stack_map =
+            build_inline_stack_map(file).unwrap_or_else(|_| InlineStackMap::empty());
+
+        let library_info = LibraryInfo {
+            name: name.clone(),
+            debug_name: name,
+            path: path.clone(),
+            debug_path: path,
+            debug_id,
+            code_id,
+            arch: None,
+            symbol_table: Some(Arc::new(SymbolTable::new(symbols))),
+        };
+
+        Ok(Self {
+            library_info,
+            inline_stack_map,
+        })
+    }
+
+    pub fn empty(file_path: &Path) -> Self {
+        let (name, path) = name_and_path(file_path);
+        let library_info = LibraryInfo {
+            name: name.clone(),
+            debug_name: name,
+            path: path.clone(),
+            debug_path: path,
+            debug_id: DebugId::default(),
+            code_id: None,
+            arch: None,
+            symbol_table: None,
+        };
+        let inline_stack_map = InlineStackMap::empty();
+        Self {
+            library_info,
+            inline_stack_map,
+        }
+    }
+
+    pub fn name(&self) -> &str {
+        &self.library_info.name
+    }
+
+    pub fn library_info(&self) -> &LibraryInfo {
+        &self.library_info
+    }
+
+    pub fn inline_stack_map(&self) -> &InlineStackMap {
+        &self.inline_stack_map
+    }
+}
+
+fn build_inline_stack_map(file: object::File) -> Result<InlineStackMap> {
+    let endian = if file.is_little_endian() {
+        gimli::RunTimeEndian::Little
+    } else {
+        gimli::RunTimeEndian::Big
+    };
+    fn load_section<'a>(file: &'a object::File, id: gimli::SectionId) -> Result<Cow<'a, [u8]>> {
+        let input = match file.section_by_name(id.name()) {
+            Some(section) => section.uncompressed_data()?,
+            None => Cow::Owned(vec![]),
+        };
+        Ok(input)
+    }
+    let dorf = gimli::DwarfSections::load(|id| load_section(&file, id))?;
+    let dorf = dorf.borrow(|sec| gimli::EndianSlice::new(sec, endian));
+    let mut units = dorf.units();
+    let mut frames = InlineStackMap::builder();
+    while let Some(header) = units.next()? {
+        let unit = dorf.unit(header)?;
+        let mut entree = unit.entries_tree(None)?;
+        let root = entree.root()?;
+        let mut ctx = ParseContext {
+            dorf: &dorf,
+            unit: &unit,
+            frames: &mut frames,
+        };
+        parse_inline(&mut ctx, root)?;
+    }
+    Ok(frames.build())
+}
+
+type Reader<'a> = gimli::EndianSlice<'a, gimli::RunTimeEndian>;
+
+struct ParseContext<'a> {
+    dorf: &'a gimli::Dwarf<Reader<'a>>,
+    unit: &'a gimli::Unit<Reader<'a>>,
+    frames: &'a mut InlineStackMapBuilder,
+}
+impl ParseContext<'_> {
+    fn name_attr(&self, attr: gimli::AttributeValue<Reader>) -> Result<Option<String>> {
+        match attr {
+            gimli::AttributeValue::DebugInfoRef(offset) => {
+                let mut units = self.dorf.units();
+                while let Some(header) = units.next()? {
+                    if let Some(offset) = offset.to_unit_offset(&header) {
+                        let unit = self.dorf.unit(header)?;
+                        return self.name_entry(&unit, offset);
+                    }
+                }
+                Ok(None)
+            }
+            gimli::AttributeValue::UnitRef(offset) => self.name_entry(self.unit, offset),
+            other => {
+                bail!("unrecognized attr {other:?}");
+            }
+        }
+    }
+
+    fn name_entry(
+        &self,
+        unit: &gimli::Unit<Reader>,
+        offset: gimli::UnitOffset,
+    ) -> Result<Option<String>> {
+        let abbreviations = self.dorf.abbreviations(&unit.header)?;
+        let mut entries = unit.header.entries_raw(&abbreviations, Some(offset))?;
+        let Some(abbrev) = entries.read_abbreviation()? else {
+            return Ok(None);
+        };
+        let mut name = None;
+        for spec in abbrev.attributes() {
+            let attr = entries.read_attribute(*spec)?;
+            if attr.name() == gimli::DW_AT_linkage_name
+                || (attr.name() == gimli::DW_AT_name && name.is_none())
+            {
+                name = Some(self.dorf.attr_string(unit, attr.value())?)
+            }
+        }
+        Ok(name.map(|n| demangle_any(&String::from_utf8_lossy(&n))))
+    }
+}
+
+fn parse_inline(ctx: &mut ParseContext, node: gimli::EntriesTreeNode<Reader>) -> Result<()> {
+    if node.entry().tag() == gimli::DW_TAG_inlined_subroutine
+        && let Some(attr) = node.entry().attr_value(gimli::DW_AT_abstract_origin)?
+        && let Some(name) = ctx.name_attr(attr)?
+    {
+        let name = Arc::new(name);
+        let mut ranges = ctx.dorf.die_ranges(ctx.unit, node.entry())?;
+        while let Some(range) = ranges.next()? {
+            let start = range.begin as u32;
+            let end = range.end as u32;
+            ctx.frames.add(start, end, name.clone());
+        }
+    }
+    let mut children = node.children();
+    while let Some(child) = children.next()? {
+        parse_inline(ctx, child)?;
+    }
+    Ok(())
+}
+
+fn name_and_path(file_path: &Path) -> (String, String) {
+    let normalized = normpath::PathExt::normalize(file_path);
+    let path = normalized
+        .as_ref()
+        .map(|n| n.as_path())
+        .unwrap_or(file_path);
+
+    let name = match path.file_stem() {
+        Some(s) => s.to_string_lossy().into_owned(),
+        None => "game".to_string(),
+    };
+    let path = path.to_string_lossy().into_owned();
+    (name, path)
+}

src/emulator/inline_stack_map.rs

@@ -0,0 +1,87 @@
+use std::{
+    collections::{BTreeMap, HashMap},
+    sync::Arc,
+};
+
+pub type InlineStack = Arc<Vec<Arc<String>>>;
+
+#[derive(Debug, Clone)]
+pub struct InlineStackMap {
+    entries: Vec<(u32, InlineStack)>,
+    empty: InlineStack,
+}
+
+impl InlineStackMap {
+    pub fn empty() -> Self {
+        Self {
+            entries: vec![],
+            empty: Arc::new(vec![]),
+        }
+    }
+    pub fn builder() -> InlineStackMapBuilder {
+        InlineStackMapBuilder {
+            events: BTreeMap::new(),
+        }
+    }
+    pub fn get(&self, address: u32) -> &InlineStack {
+        match self.entries.binary_search_by_key(&address, |(a, _)| *a) {
+            Ok(index) => self.entries.get(index),
+            Err(after) => after.checked_sub(1).and_then(|i| self.entries.get(i)),
+        }
+        .map(|(_, s)| s)
+        .unwrap_or(&self.empty)
+    }
+}
+
+#[derive(Default)]
+struct Event {
+    end: usize,
+    start: Vec<Arc<String>>,
+}
+
+pub struct InlineStackMapBuilder {
+    events: BTreeMap<u32, Event>,
+}
+
+impl InlineStackMapBuilder {
+    pub fn add(&mut self, start: u32, end: u32, name: Arc<String>) {
+        self.events.entry(start).or_default().start.push(name);
+        self.events.entry(end).or_default().end += 1;
+    }
+
+    pub fn build(self) -> InlineStackMap {
+        let empty = Arc::new(vec![]);
+        let mut entries = vec![];
+        let mut stack_indexes = vec![];
+        let mut stack = vec![];
+        let mut string_dedup = HashMap::new();
+        let mut stack_dedup = BTreeMap::new();
+        stack_dedup.insert(vec![], empty.clone());
+
+        for (address, event) in self.events {
+            for _ in 0..event.end {
+                stack.pop();
+                stack_indexes.pop();
+            }
+            for call in event.start {
+                if let Some(index) = string_dedup.get(&call) {
+                    stack.push(call);
+                    stack_indexes.push(*index);
+                } else {
+                    let index = string_dedup.len();
+                    string_dedup.insert(call.clone(), index);
+                    stack.push(call);
+                    stack_indexes.push(index);
+                }
+            }
+            if let Some(stack) = stack_dedup.get(&stack_indexes) {
+                entries.push((address, stack.clone()));
+            } else {
+                let stack = Arc::new(stack.clone());
+                stack_dedup.insert(stack_indexes.clone(), stack.clone());
+                entries.push((address, stack));
+            }
+        }
+        InlineStackMap { entries, empty }
+    }
+}

src/emulator/shrooms_vb_core.rs

@@ -1,10 +1,12 @@
-use std::{ffi::c_void, ptr, slice};
+use std::{borrow::Cow, ffi::c_void, ptr, slice, sync::Arc};
 
 use anyhow::{Result, anyhow};
 use bitflags::bitflags;
 use num_derive::{FromPrimitive, ToPrimitive};
 use serde::{Deserialize, Serialize};
 
+use crate::emulator::inline_stack_map::{InlineStack, InlineStackMap};
+
 use super::address_set::AddressSet;
 
 #[repr(C)]
@@ -71,8 +73,16 @@ pub enum VBWatchpointType {
     Access,
 }
 
+type OnException = extern "C" fn(sim: *mut VB, cause: *mut u16) -> c_int;
 type OnExecute =
     extern "C" fn(sim: *mut VB, address: u32, code: *const u16, length: c_int) -> c_int;
+type OnFetch = extern "C" fn(
+    sim: *mut VB,
+    fetch: c_int,
+    address: u32,
+    value: *mut i32,
+    cycles: *mut u32,
+) -> c_int;
 type OnFrame = extern "C" fn(sim: *mut VB) -> c_int;
 type OnRead = extern "C" fn(
     sim: *mut VB,
@@ -135,8 +145,15 @@ unsafe extern "C" {
     fn vb_set_cart_ram(sim: *mut VB, sram: *mut c_void, size: u32) -> c_int;
     #[link_name = "vbSetCartROM"]
     fn vb_set_cart_rom(sim: *mut VB, rom: *mut c_void, size: u32) -> c_int;
+    #[link_name = "vbSetExceptionCallback"]
+    fn vb_set_exception_callback(
+        sim: *mut VB,
+        callback: Option<OnException>,
+    ) -> Option<OnException>;
     #[link_name = "vbSetExecuteCallback"]
     fn vb_set_execute_callback(sim: *mut VB, callback: Option<OnExecute>) -> Option<OnExecute>;
+    #[link_name = "vbSetFetchCallback"]
+    fn vb_set_fetch_callback(sim: *mut VB, callback: Option<OnFetch>) -> Option<OnFetch>;
     #[link_name = "vbSetFrameCallback"]
     fn vb_set_frame_callback(sim: *mut VB, callback: Option<OnFrame>) -> Option<OnFrame>;
     #[link_name = "vbSetKeys"]
@@ -176,16 +193,27 @@ extern "C" fn on_frame(sim: *mut VB) -> c_int {
     // There is no way for the userdata to be null or otherwise invalid.
     let data: &mut VBState = unsafe { &mut *vb_get_user_data(sim).cast() };
     data.frame_seen = true;
+    if data.monitor.enabled {
+        data.monitor.event = Some(SimEvent::Marker(Cow::Borrowed("Frame Drawn")));
+    }
     1
 }
 
 #[unsafe(no_mangle)]
-extern "C" fn on_execute(sim: *mut VB, address: u32, _code: *const u16, _length: c_int) -> c_int {
+extern "C" fn on_execute(sim: *mut VB, address: u32, code: *const u16, length: c_int) -> c_int {
     // SAFETY: the *mut VB owns its userdata.
     // There is no way for the userdata to be null or otherwise invalid.
     let data: &mut VBState = unsafe { &mut *vb_get_user_data(sim).cast() };
 
-    let mut stopped = data.stop_reason.is_some();
+    if data.monitor.enabled {
+        // SAFETY: length is the length of code, in elements
+        let code = unsafe { slice::from_raw_parts(code, length as usize) };
+        data.monitor.detect_event(sim, address, code);
+        // Something interesting will happen after this instruction is run.
+        // We'll react in the on_fetch callback it does.
+    }
+
+    let mut stopped = data.stop_reason.is_some() || data.monitor.event.is_some();
     if data.step_from.is_some_and(|s| s != address) {
         data.step_from = None;
         data.stop_reason = Some(StopReason::Stepped);
@@ -199,6 +227,49 @@ extern "C" fn on_execute(sim: *mut VB, address: u32, _code: *const u16, _length:
     if stopped { 1 } else { 0 }
 }
 
+#[unsafe(no_mangle)]
+extern "C" fn on_fetch(
+    sim: *mut VB,
+    _fetch: c_int,
+    address: u32,
+    _value: *mut i32,
+    _cycles: *mut u32,
+) -> c_int {
+    // SAFETY: the *mut VB owns its userdata.
+    // There is no way for the userdata to be null or otherwise invalid.
+    let data: &mut VBState = unsafe { &mut *vb_get_user_data(sim).cast() };
+    data.monitor.event = data.monitor.queued_event.take();
+    data.monitor.new_inline_stack = data.monitor.detect_new_inline_stack(address);
+    unsafe { vb_set_exception_callback(sim, Some(on_exception)) };
+    if data.monitor.event.is_some() || data.monitor.new_inline_stack.is_some() {
+        1
+    } else {
+        0
+    }
+}
+
+#[unsafe(no_mangle)]
+extern "C" fn on_exception(sim: *mut VB, cause: *mut u16) -> c_int {
+    // SAFETY: the *mut VB owns its userdata.
+    // There is no way for the userdata to be null or otherwise invalid.
+    let data: &mut VBState = unsafe { &mut *vb_get_user_data(sim).cast() };
+    let cause = unsafe { *cause };
+    let pc = if cause == 0xff70 {
+        0xffffff60
+    } else {
+        (cause & 0xfff0) as u32 | 0xffff0000
+    };
+    data.monitor.event = data.monitor.queued_event.take();
+    data.monitor.new_inline_stack = data.monitor.detect_new_inline_stack(pc);
+    data.monitor.queued_event = Some(SimEvent::Interrupt(cause, pc));
+    unsafe { vb_set_exception_callback(sim, None) };
+    if data.monitor.event.is_some() || data.monitor.new_inline_stack.is_some() {
+        1
+    } else {
+        0
+    }
+}
+
 #[unsafe(no_mangle)]
 extern "C" fn on_read(
     sim: *mut VB,
@@ -229,7 +300,7 @@ extern "C" fn on_read(
 extern "C" fn on_write(
     sim: *mut VB,
     address: u32,
-    _type: VBDataType,
+    typ_: VBDataType,
     value: *mut i32,
     _cycles: *mut u32,
     _cancel: *mut c_int,
@@ -246,6 +317,29 @@ extern "C" fn on_write(
         }
     }
 
+    // If we have profiling enabled, track custom markers
+    if data.monitor.enabled {
+        let normalized_hw_address = address & 0x0700003f;
+        if normalized_hw_address == 0x02000038 && matches!(typ_, VBDataType::S32) {
+            assert!(data.monitor.queued_event.is_none());
+            // The game has written the address of a null-terminated string
+            // (whose length is at most 64 bytes). Read that string.
+            let str_address = unsafe { *value } as u32;
+            let mut bytes = [0u8; 64];
+            let mut len = 0;
+            for (dst, src_address) in bytes.iter_mut().zip(str_address..str_address + 64) {
+                let char = unsafe { vb_read(sim, src_address, VBDataType::U8) } as u8;
+                if char == 0 {
+                    break;
+                }
+                *dst = char;
+                len += 1;
+            }
+            let name = String::from_utf8_lossy(&bytes[..len]).into_owned();
+            data.monitor.queued_event = Some(SimEvent::Marker(Cow::Owned(name)));
+        }
+    }
+
     if let Some(start) = data.write_watchpoints.start_of_range_containing(address) {
         let watch = if data.read_watchpoints.contains(address) {
             VBWatchpointType::Access
@@ -260,6 +354,117 @@ extern "C" fn on_write(
     0
 }
 
+#[allow(dead_code)]
+#[derive(Debug)]
+pub enum SimEvent {
+    Call(u32),
+    Return,
+    Halt,
+    Interrupt(u16, u32),
+    Reti,
+    Marker(Cow<'static, str>),
+}
+
+struct EventMonitor {
+    enabled: bool,
+    event: Option<SimEvent>,
+    queued_event: Option<SimEvent>,
+    just_halted: bool,
+    inline_stack_map: InlineStackMap,
+    new_inline_stack: Option<InlineStack>,
+    last_inline_stack: InlineStack,
+}
+
+impl EventMonitor {
+    fn new() -> Self {
+        let inline_stack_map = InlineStackMap::empty();
+        let last_inline_stack = inline_stack_map.get(0).clone();
+        Self {
+            enabled: false,
+            event: None,
+            queued_event: None,
+            just_halted: false,
+            inline_stack_map,
+            new_inline_stack: None,
+            last_inline_stack,
+        }
+    }
+
+    fn detect_new_inline_stack(&mut self, address: u32) -> Option<InlineStack> {
+        let stack = self.inline_stack_map.get(address);
+        if Arc::ptr_eq(stack, &self.last_inline_stack) {
+            return None;
+        }
+        self.last_inline_stack = stack.clone();
+        Some(stack.clone())
+    }
+
+    fn detect_event(&mut self, sim: *mut VB, address: u32, code: &[u16]) -> bool {
+        self.queued_event = self.do_detect_event(sim, address, code);
+        self.queued_event.is_some()
+    }
+
+    fn do_detect_event(&mut self, sim: *mut VB, address: u32, code: &[u16]) -> Option<SimEvent> {
+        const HALT_OPCODE: u16 = 0b011010;
+        const JAL_OPCODE: u16 = 0b101011;
+        const JMP_OPCODE: u16 = 0b000110;
+        const RETI_OPCODE: u16 = 0b011001;
+
+        const fn format_i_reg_1(code: &[u16]) -> u8 {
+            (code[0] & 0x1f) as u8
+        }
+
+        const fn format_iv_disp(code: &[u16]) -> i32 {
+            let value = ((code[0] & 0x3ff) as i32) << 16 | (code[1] as i32);
+            value << 6 >> 6
+        }
+
+        let opcode = code[0] >> 10;
+
+        if opcode == HALT_OPCODE {
+            if !self.just_halted {
+                self.just_halted = true;
+                self.event = Some(SimEvent::Halt);
+            } else {
+                self.just_halted = false;
+            }
+            // Don't _return_ an event, we want to emit this right away.
+            // If the CPU is halting, no other callbacks will run for a long time.
+            return None;
+        }
+
+        if opcode == JAL_OPCODE {
+            let disp = format_iv_disp(code);
+            if disp != 4 {
+                // JAL .+4 is how programs get r31 to a known value for indirect calls
+                // (which we detect later.)
+                // Any other JAL is a function call.
+                return Some(SimEvent::Call(address.wrapping_add_signed(disp)));
+            }
+        }
+
+        if opcode == JMP_OPCODE {
+            let jmp_reg = format_i_reg_1(code);
+            if jmp_reg == 31 {
+                // JMP[r31] is a return
+                return Some(SimEvent::Return);
+            }
+            let r31 = unsafe { vb_get_program_register(sim, 31) };
+            if r31 as u32 == address.wrapping_add(2) {
+                // JMP anywhere else, if r31 points to after the JMP, is an indirect call
+                let target = unsafe { vb_get_program_register(sim, jmp_reg as u32) };
+                return Some(SimEvent::Call(target as u32));
+            }
+        }
+
+        if opcode == RETI_OPCODE {
+            return Some(SimEvent::Reti);
+        }
+
+        None
+    }
+}
+
 const AUDIO_CAPACITY_SAMPLES: usize = 834 * 4;
 const AUDIO_CAPACITY_FLOATS: usize = AUDIO_CAPACITY_SAMPLES * 2;
 pub const EXPECTED_FRAME_SIZE: usize = 834 * 2;
@@ -267,6 +472,7 @@ pub const EXPECTED_FRAME_SIZE: usize = 834 * 2;
 struct VBState {
     frame_seen: bool,
     stop_reason: Option<StopReason>,
+    monitor: EventMonitor,
     step_from: Option<u32>,
     breakpoints: Vec<u32>,
     read_watchpoints: AddressSet,
@@ -277,10 +483,15 @@ struct VBState {
 impl VBState {
     fn needs_execute_callback(&self) -> bool {
         self.step_from.is_some()
+            || self.monitor.enabled
             || !self.breakpoints.is_empty()
             || !self.read_watchpoints.is_empty()
             || !self.write_watchpoints.is_empty()
     }
+
+    fn needs_write_callback(&self) -> bool {
+        self.stdout.is_some() || self.monitor.enabled || !self.write_watchpoints.is_empty()
+    }
 }
 
 pub enum StopReason {
@@ -311,6 +522,7 @@ impl Sim {
         let state = VBState {
             frame_seen: false,
             stop_reason: None,
+            monitor: EventMonitor::new(),
             step_from: None,
             breakpoints: vec![],
             read_watchpoints: AddressSet::new(),
@@ -332,6 +544,33 @@ impl Sim {
         unsafe { vb_reset(self.sim) };
     }
 
+    pub fn monitor_events(&mut self, enabled: bool, inline_stack_map: InlineStackMap) {
+        let state = self.get_state();
+        state.monitor.enabled = enabled;
+        state.monitor.event = None;
+        state.monitor.queued_event = None;
+        state.monitor.new_inline_stack = None;
+        state.monitor.last_inline_stack = inline_stack_map.get(0).clone();
+        state.monitor.inline_stack_map = inline_stack_map;
+        if enabled {
+            unsafe { vb_set_execute_callback(self.sim, Some(on_execute)) };
+            unsafe { vb_set_exception_callback(self.sim, Some(on_exception)) };
+            unsafe { vb_set_fetch_callback(self.sim, Some(on_fetch)) };
+            unsafe { vb_set_write_callback(self.sim, Some(on_write)) };
+        } else {
+            let needs_execute = state.needs_execute_callback();
+            let needs_write = state.needs_write_callback();
+            if !needs_execute {
+                unsafe { vb_set_execute_callback(self.sim, None) };
+            }
+            unsafe { vb_set_exception_callback(self.sim, None) };
+            unsafe { vb_set_fetch_callback(self.sim, None) };
+            if !needs_write {
+                unsafe { vb_set_write_callback(self.sim, None) };
+            }
+        }
+    }
+
     pub fn load_cart(&mut self, mut rom: Vec<u8>, mut sram: Vec<u8>) -> Result<()> {
         self.unload_cart();
 
@@ -394,16 +633,14 @@ impl Sim {
         unsafe { vb_set_peer(self.sim, ptr::null_mut()) };
     }
 
-    pub fn emulate(&mut self) {
-        let mut cycles = 20_000_000;
-        unsafe { vb_emulate(self.sim, &mut cycles) };
+    pub fn emulate(&mut self, cycles: &mut u32) {
+        unsafe { vb_emulate(self.sim, cycles) };
     }
 
-    pub fn emulate_many(sims: &mut [Sim]) {
-        let mut cycles = 20_000_000;
+    pub fn emulate_many(sims: &mut [Sim], cycles: &mut u32) {
         let count = sims.len() as c_uint;
         let sims = sims.as_mut_ptr().cast();
-        unsafe { vb_emulate_ex(sims, count, &mut cycles) };
+        unsafe { vb_emulate_ex(sims, count, cycles) };
     }
 
     pub fn read_pixels(&mut self, buffers: &mut [u8]) -> bool {
@@ -572,9 +809,10 @@ impl Sim {
     fn remove_write_watchpoint(&mut self, address: u32, length: usize) {
         let state = self.get_state();
         state.write_watchpoints.remove(address, length);
+        let needs_write = state.needs_write_callback();
         let needs_execute = state.needs_execute_callback();
         if state.write_watchpoints.is_empty() {
-            if state.stdout.is_none() {
+            if !needs_write {
                 unsafe { vb_set_write_callback(self.sim, None) };
             }
             if !needs_execute {
@@ -598,12 +836,15 @@ impl Sim {
         data.breakpoints.clear();
         data.read_watchpoints.clear();
         data.write_watchpoints.clear();
-        let needs_write = data.stdout.is_some();
+        let needs_write = data.needs_write_callback();
+        let needs_execute = data.needs_execute_callback();
         unsafe { vb_set_read_callback(self.sim, None) };
         if !needs_write {
             unsafe { vb_set_write_callback(self.sim, None) };
         }
-        unsafe { vb_set_execute_callback(self.sim, None) };
+        if !needs_execute {
+            unsafe { vb_set_execute_callback(self.sim, None) };
+        }
     }
 
     pub fn watch_stdout(&mut self, watch: bool) {
@@ -615,7 +856,7 @@ impl Sim {
             }
         } else {
             data.stdout.take();
-            if data.write_watchpoints.is_empty() {
+            if !data.needs_write_callback() {
                 unsafe { vb_set_write_callback(self.sim, None) };
             }
         }
@@ -632,7 +873,7 @@ impl Sim {
         Some(string)
     }
 
-    pub fn stop_reason(&mut self) -> Option<StopReason> {
+    pub fn take_stop_reason(&mut self) -> Option<StopReason> {
         let data = self.get_state();
         let reason = data.stop_reason.take();
         if !data.needs_execute_callback() {
@@ -641,6 +882,13 @@ impl Sim {
         reason
     }
 
+    pub fn take_profiler_updates(&mut self) -> (Option<SimEvent>, Option<InlineStack>) {
+        let data = self.get_state();
+        let event = data.monitor.event.take();
+        let inline_stack = data.monitor.new_inline_stack.take();
+        (event, inline_stack)
+    }
+
     fn get_state(&mut self) -> &mut VBState {
         // SAFETY: the *mut VB owns its userdata.
         // There is no way for the userdata to be null or otherwise invalid.

src/main.rs

@@ -22,6 +22,7 @@ mod images;
 mod input;
 mod memory;
 mod persistence;
+mod profiler;
 mod window;
 
 #[derive(Parser)]
@@ -31,6 +32,9 @@ struct Args {
     /// Start a GDB/LLDB debug server on this port.
     #[arg(short, long)]
     debug_port: Option<u16>,
+    /// Enable profiling a game
+    #[arg(short, long)]
+    profile: bool,
 }
 
 fn init_logger() {
@@ -106,6 +110,9 @@ fn main() -> Result<()> {
         }
         builder = builder.start_paused(true);
     }
+    if args.profile {
+        builder = builder.start_paused(true)
+    }
 
     ThreadBuilder::default()
         .name("Emulator".to_owned())
@@ -124,6 +131,11 @@ fn main() -> Result<()> {
     let event_loop = EventLoop::with_user_event().build().unwrap();
     event_loop.set_control_flow(ControlFlow::Poll);
     let proxy = event_loop.create_proxy();
-    event_loop.run_app(&mut Application::new(client, proxy, args.debug_port))?;
+    event_loop.run_app(&mut Application::new(
+        client,
+        proxy,
+        args.debug_port,
+        args.profile,
+    ))?;
     Ok(())
 }

src/profiler.rs

@@ -0,0 +1,264 @@
+use std::{
+    sync::{Arc, Mutex},
+    thread,
+};
+
+use anyhow::Result;
+use tokio::{select, sync::mpsc};
+
+use crate::emulator::{
+    EmulatorClient, EmulatorCommand, GameInfo, InlineStack, ProfileEvent, SimEvent, SimId,
+};
+use recording::Recording;
+use state::ProgramState;
+
+mod recording;
+mod state;
+
+pub struct Profiler {
+    sim_id: SimId,
+    client: EmulatorClient,
+    status: Arc<Mutex<ProfilerStatus>>,
+    action: Option<mpsc::UnboundedSender<RecordingAction>>,
+    killer: Option<oneshot::Sender<()>>,
+}
+
+impl Profiler {
+    pub fn new(sim_id: SimId, client: EmulatorClient) -> Self {
+        Self {
+            sim_id,
+            client,
+            status: Arc::new(Mutex::new(ProfilerStatus::Disabled)),
+            action: None,
+            killer: None,
+        }
+    }
+
+    pub fn status(&self) -> ProfilerStatus {
+        self.status.lock().unwrap().clone()
+    }
+
+    pub fn enable(&mut self) {
+        let sim_id = self.sim_id;
+        let client = self.client.clone();
+        let status = self.status.clone();
+        let (action_tx, action_rx) = mpsc::unbounded_channel();
+        self.action = Some(action_tx);
+        let (killer_tx, killer_rx) = oneshot::channel();
+        self.killer = Some(killer_tx);
+        thread::spawn(move || {
+            tokio::runtime::Builder::new_current_thread()
+                .enable_all()
+                .build()
+                .unwrap()
+                .block_on(async move {
+                    select! {
+                        _ = run_profile(sim_id, client, status.clone(), action_rx) => {}
+                        _ = killer_rx => {
+                            *status.lock().unwrap() = ProfilerStatus::Disabled;
+                        }
+                    }
+                })
+        });
+    }
+
+    pub fn disable(&mut self) {
+        if let Some(killer) = self.killer.take() {
+            let _ = killer.send(());
+        }
+    }
+
+    pub fn start_recording(&mut self) {
+        if let Some(action) = &self.action {
+            let _ = action.send(RecordingAction::Start);
+        }
+    }
+
+    pub fn finish_recording(&mut self) -> oneshot::Receiver<Vec<u8>> {
+        let (tx, rx) = oneshot::channel();
+        if let Some(action) = &self.action {
+            let _ = action.send(RecordingAction::Finish(tx));
+        }
+        rx
+    }
+
+    pub fn cancel_recording(&mut self) {
+        if let Some(action) = &self.action {
+            let _ = action.send(RecordingAction::Cancel);
+        }
+    }
+}
+
+impl Drop for Profiler {
+    fn drop(&mut self) {
+        self.disable();
+    }
+}
+
+async fn run_profile(
+    sim_id: SimId,
+    client: EmulatorClient,
+    status: Arc<Mutex<ProfilerStatus>>,
+    mut action_source: mpsc::UnboundedReceiver<RecordingAction>,
+) {
+    let (profile_sync, mut profile_source) = mpsc::unbounded_channel();
+    client.send_command(EmulatorCommand::StartProfiling(sim_id, profile_sync));
+
+    *status.lock().unwrap() = ProfilerStatus::Enabled;
+
+    let mut session = ProfilerSession::new();
+    loop {
+        select! {
+            maybe_event = profile_source.recv() => {
+                let Some(event) = maybe_event else {
+                    break; // emulator thread disconnected
+                };
+                if let Err(error) = handle_event(event, &mut session).await {
+                    *status.lock().unwrap() = ProfilerStatus::Error(error.to_string());
+                    return;
+                }
+            }
+            maybe_action = action_source.recv() => {
+                let Some(action) = maybe_action else {
+                    break; // ui thread disconnected
+                };
+                handle_action(action, &mut session, &status);
+            }
+        }
+    }
+
+    *status.lock().unwrap() = ProfilerStatus::Disabled;
+}
+
+async fn handle_event(event: ProfileEvent, session: &mut ProfilerSession) -> Result<()> {
+    match event {
+        ProfileEvent::Start { info } => session.start_profiling(info).await,
+        ProfileEvent::Update {
+            cycles,
+            event,
+            inline_stack,
+        } => {
+            session.track_elapsed_cycles(cycles);
+            if let Some(event) = event {
+                session.track_event(event)?;
+            }
+            if let Some(stack) = inline_stack {
+                session.track_inline_stack(stack);
+            }
+        }
+    }
+    Ok(())
+}
+
+fn handle_action(
+    action: RecordingAction,
+    session: &mut ProfilerSession,
+    status: &Mutex<ProfilerStatus>,
+) {
+    match action {
+        RecordingAction::Start => {
+            session.start_recording();
+            *status.lock().unwrap() = ProfilerStatus::Recording;
+        }
+        RecordingAction::Finish(rx) => {
+            if let Some(bytes) = session.finish_recording() {
+                let _ = rx.send(bytes);
+            }
+            *status.lock().unwrap() = ProfilerStatus::Enabled;
+        }
+        RecordingAction::Cancel => {
+            session.cancel_recording();
+            *status.lock().unwrap() = ProfilerStatus::Enabled;
+        }
+    }
+}
+
+#[derive(Clone)]
+pub enum ProfilerStatus {
+    Disabled,
+    Enabled,
+    Recording,
+    Error(String),
+}
+
+impl ProfilerStatus {
+    pub fn enabled(&self) -> bool {
+        matches!(self, Self::Enabled | Self::Recording)
+    }
+}
+
+enum RecordingAction {
+    Start,
+    Finish(oneshot::Sender<Vec<u8>>),
+    Cancel,
+}
+
+struct ProfilerSession {
+    program: Option<ProgramState>,
+    recording: Option<Recording>,
+}
+
+impl ProfilerSession {
+    fn new() -> Self {
+        Self {
+            program: None,
+            recording: None,
+        }
+    }
+
+    async fn start_profiling(&mut self, info: Arc<GameInfo>) {
+        let program = ProgramState::new(info).await;
+        let recording = if self.recording.is_some() {
+            Some(Recording::new(&program))
+        } else {
+            None
+        };
+        self.program = Some(program);
+        self.recording = recording;
+    }
+
+    fn track_elapsed_cycles(&mut self, cycles: u32) {
+        if let (Some(state), Some(recording)) = (&self.program, &mut self.recording) {
+            recording.track_elapsed_cycles(state, cycles);
+        }
+    }
+
+    fn track_event(&mut self, event: SimEvent) -> Result<()> {
+        let Some(program) = &mut self.program else {
+            return Ok(());
+        };
+        match event {
+            SimEvent::Call(address) => program.track_call(address),
+            SimEvent::Return => program.track_return(),
+            SimEvent::Halt => program.track_halt(),
+            SimEvent::Interrupt(code, address) => program.track_interrupt(code, address),
+            SimEvent::Reti => program.track_reti(),
+            SimEvent::Marker(name) => {
+                if let Some(recording) = &mut self.recording {
+                    recording.track_marker(name);
+                };
+                Ok(())
+            }
+        }
+    }
+
+    fn track_inline_stack(&mut self, inline_stack: InlineStack) {
+        if let Some(program) = &mut self.program {
+            program.track_inline_stack(inline_stack);
+        }
+    }
+
+    fn start_recording(&mut self) {
+        if let Some(program) = &self.program {
+            self.recording = Some(Recording::new(program));
+        }
+    }
+
+    fn finish_recording(&mut self) -> Option<Vec<u8>> {
+        self.recording.take().map(|r| r.finish())
+    }
+
+    fn cancel_recording(&mut self) {
+        self.recording.take();
+    }
+}

src/profiler/recording.rs

@@ -0,0 +1,152 @@
+use std::{borrow::Cow, collections::HashMap};
+
+use fxprof_processed_profile::{
+    CategoryHandle, CpuDelta, Frame, FrameFlags, FrameInfo, MarkerTiming, ProcessHandle, Profile,
+    ReferenceTimestamp, SamplingInterval, StackHandle, StaticSchemaMarker, StringHandle,
+    ThreadHandle, Timestamp,
+};
+
+use crate::profiler::state::{ProgramState, RESET_CODE, StackFrame};
+
+pub struct Recording {
+    profile: Profile,
+    process: ProcessHandle,
+    threads: HashMap<u16, ThreadHandle>,
+    now: u64,
+}
+
+impl Recording {
+    pub fn new(state: &ProgramState) -> Self {
+        let reference_timestamp = ReferenceTimestamp::from_millis_since_unix_epoch(0.0);
+        let interval = SamplingInterval::from_hz(20_000_000.0);
+        let mut profile = Profile::new(state.name(), reference_timestamp, interval);
+
+        let process =
+            profile.add_process(state.name(), 1, Timestamp::from_nanos_since_reference(0));
+
+        let lib = profile.add_lib(state.library_info().clone());
+        profile.add_lib_mapping(process, lib, 0x00000000, 0xffffffff, 0);
+
+        let mut me = Self {
+            profile,
+            process,
+            threads: HashMap::new(),
+            now: 0,
+        };
+        me.track_elapsed_cycles(state, 0);
+        me
+    }
+
+    pub fn track_elapsed_cycles(&mut self, state: &ProgramState, cycles: u32) {
+        self.now += cycles as u64;
+        let timestamp = Timestamp::from_nanos_since_reference(self.now * 50);
+        let weight = 1;
+
+        let active_code = if let Some((code, frames)) = state.current_stack() {
+            let thread = *self.threads.entry(code).or_insert_with(|| {
+                let process = self.process;
+                let tid = code as u32;
+                let start_time = Timestamp::from_nanos_since_reference(self.now * 50);
+                let is_main = code == RESET_CODE;
+                let thread = self.profile.add_thread(process, tid, start_time, is_main);
+                self.profile
+                    .set_thread_name(thread, &thread_name_for_code(code));
+                thread
+            });
+
+            let stack = self.handle_for_stack(thread, frames);
+            let cpu_delta = CpuDelta::from_nanos((self.now - cycles as u64) * 50);
+            self.profile
+                .add_sample(thread, timestamp, stack, cpu_delta, weight);
+            Some(code)
+        } else {
+            None
+        };
+        for (code, thread) in &self.threads {
+            if active_code == Some(*code) {
+                continue;
+            }
+            self.profile
+                .add_sample_same_stack_zero_cpu(*thread, timestamp, weight);
+        }
+    }
+
+    pub fn track_marker(&mut self, name: Cow<'static, str>) {
+        let Some(thread) = self.threads.get(&RESET_CODE) else {
+            return;
+        };
+        let timing = MarkerTiming::Instant(Timestamp::from_nanos_since_reference(self.now * 50));
+        let marker = SimpleMarker(name);
+        self.profile.add_marker(*thread, timing, marker);
+    }
+
+    pub fn finish(self) -> Vec<u8> {
+        serde_json::to_vec(&self.profile).expect("could not serialize profile")
+    }
+
+    fn handle_for_stack(
+        &mut self,
+        thread: ThreadHandle,
+        frames: &[StackFrame],
+    ) -> Option<StackHandle> {
+        let frames = frames
+            .iter()
+            .map(|f| {
+                let frame = match f {
+                    StackFrame::Address(address) => Frame::InstructionPointer(*address as u64),
+                    StackFrame::Label(label) => Frame::Label(self.profile.intern_string(label)),
+                };
+                FrameInfo {
+                    frame,
+                    category_pair: CategoryHandle::OTHER.into(),
+                    flags: FrameFlags::empty(),
+                }
+            })
+            .collect::<Vec<_>>();
+        self.profile.intern_stack_frames(thread, frames.into_iter())
+    }
+}
+
+struct SimpleMarker(Cow<'static, str>);
+
+impl StaticSchemaMarker for SimpleMarker {
+    const UNIQUE_MARKER_TYPE_NAME: &'static str = "Simple";
+    const FIELDS: &'static [fxprof_processed_profile::StaticSchemaMarkerField] = &[];
+
+    fn name(&self, profile: &mut Profile) -> StringHandle {
+        profile.intern_string(&self.0)
+    }
+
+    fn category(&self, _profile: &mut Profile) -> CategoryHandle {
+        CategoryHandle::OTHER
+    }
+
+    fn string_field_value(&self, _field_index: u32) -> StringHandle {
+        unreachable!()
+    }
+
+    fn number_field_value(&self, _field_index: u32) -> f64 {
+        unreachable!()
+    }
+}
+
+fn thread_name_for_code(code: u16) -> std::borrow::Cow<'static, str> {
+    match code {
+        RESET_CODE => "Main".into(),
+        0xffd0 => "Duplexed exception".into(),
+        0xfe40 => "VIP interrupt".into(),
+        0xfe30 => "Communication interrupt".into(),
+        0xfe20 => "Game pak interrupt".into(),
+        0xfe10 => "Timer interrupt".into(),
+        0xfe00 => "Game pad interrupt".into(),
+        0xffc0 => "Address trap".into(),
+        0xffa0..0xffc0 => format!("Trap (vector {})", code - 0xffa0).into(),
+        0xff90 => "Illegal opcode exception".into(),
+        0xff80 => "Zero division exception".into(),
+        0xff60 => "Floating-point reserved operand exception".into(),
+        0xff70 => "Floating-point invalid operation exception".into(),
+        0xff68 => "Floating-point zero division exception".into(),
+        0xff64 => "Floating-point overflow exception".into(),
+        other => format!("Unrecognized handler (0x{other:04x})").into(),
+    }
+}

src/profiler/state.rs

@@ -0,0 +1,124 @@
+use std::{collections::HashMap, sync::Arc};
+
+use anyhow::{Result, bail};
+use fxprof_processed_profile::LibraryInfo;
+
+use crate::emulator::{GameInfo, InlineStack};
+
+pub struct ProgramState {
+    info: Arc<GameInfo>,
+    call_stacks: HashMap<u16, Vec<StackFrame>>,
+    context_stack: Vec<u16>,
+}
+
+pub enum StackFrame {
+    Address(u32),
+    Label(Arc<String>),
+}
+
+pub const RESET_CODE: u16 = 0xfff0;
+impl ProgramState {
+    pub async fn new(info: Arc<GameInfo>) -> Self {
+        let mut call_stacks = HashMap::new();
+        call_stacks.insert(RESET_CODE, vec![StackFrame::Address(0xfffffff0)]);
+        Self {
+            info,
+            call_stacks,
+            context_stack: vec![RESET_CODE],
+        }
+    }
+
+    pub fn name(&self) -> &str {
+        self.info.name()
+    }
+
+    pub fn library_info(&self) -> &LibraryInfo {
+        self.info.library_info()
+    }
+
+    pub fn current_stack(&self) -> Option<(u16, &[StackFrame])> {
+        let code = self.context_stack.last()?;
+        let call_stack = self.call_stacks.get(code)?;
+        Some((*code, call_stack))
+    }
+
+    pub fn track_call(&mut self, address: u32) -> Result<()> {
+        let Some(code) = self.context_stack.last() else {
+            bail!("How did we call anything when we're halted?");
+        };
+        let Some(stack) = self.call_stacks.get_mut(code) else {
+            bail!("missing stack {code:04x}");
+        };
+        stack.push(StackFrame::Address(address));
+        Ok(())
+    }
+
+    pub fn track_return(&mut self) -> Result<()> {
+        let Some(code) = self.context_stack.last() else {
+            bail!("how did we return when we're halted?");
+        };
+        let Some(stack) = self.call_stacks.get_mut(code) else {
+            bail!("missing stack {code:04x}");
+        };
+        if stack.pop().is_none() {
+            bail!("returned from {code:04x} but stack was empty");
+        }
+        if stack.is_empty() {
+            bail!("returned to oblivion");
+        }
+        Ok(())
+    }
+
+    pub fn track_halt(&mut self) -> Result<()> {
+        let Some(RESET_CODE) = self.context_stack.pop() else {
+            bail!("halted when not in an interrupt");
+        };
+        Ok(())
+    }
+
+    pub fn track_interrupt(&mut self, code: u16, address: u32) -> Result<()> {
+        // if the CPU was halted before, wake it up now
+        if self.context_stack.is_empty() {
+            self.context_stack.push(RESET_CODE);
+        }
+
+        self.context_stack.push(code);
+        if self
+            .call_stacks
+            .insert(code, vec![StackFrame::Address(address)])
+            .is_some()
+        {
+            bail!("{code:04x} fired twice");
+        }
+        Ok(())
+    }
+
+    pub fn track_reti(&mut self) -> Result<()> {
+        let Some(code) = self.context_stack.pop() else {
+            bail!("RETI when halted");
+        };
+        if code == RESET_CODE {
+            bail!("RETI when not in interrupt");
+        }
+        if self.call_stacks.remove(&code).is_none() {
+            bail!("{code:04x} popped but never called");
+        }
+        Ok(())
+    }
+
+    pub fn track_inline_stack(&mut self, inline_stack: InlineStack) {
+        let Some(code) = self.context_stack.last() else {
+            return;
+        };
+        let Some(call_stack) = self.call_stacks.get_mut(code) else {
+            return;
+        };
+        while call_stack
+            .pop_if(|f| matches!(f, StackFrame::Label(_)))
+            .is_some()
+        {}
+        for label in inline_stack.iter() {
+            call_stack.push(StackFrame::Label(label.clone()));
+        }
+    }
+}

src/window.rs

@@ -4,6 +4,7 @@ pub use game::GameWindow;
 pub use gdb::GdbServerWindow;
 pub use hotkeys::HotkeysWindow;
 pub use input::InputWindow;
+pub use profile::ProfileWindow;
 pub use terminal::TerminalWindow;
 pub use vip::{
     BgMapWindow, CharacterDataWindow, FrameBufferWindow, ObjectWindow, RegisterWindow, WorldWindow,
@@ -18,6 +19,7 @@ mod game_screen;
 mod gdb;
 mod hotkeys;
 mod input;
+mod profile;
 mod terminal;
 mod utils;
 mod vip;

src/window/game.rs

@@ -228,6 +228,11 @@ impl GameWindow {
                     .send_event(UserEvent::OpenTerminal(self.sim_id))
                     .unwrap();
             }
+            if ui.button("Profiler").clicked() {
+                self.proxy
+                    .send_event(UserEvent::OpenProfiler(self.sim_id))
+                    .unwrap();
+            }
             if ui.button("GDB Server").clicked() {
                 self.proxy
                     .send_event(UserEvent::OpenDebugger(self.sim_id))

src/window/profile.rs

@@ -0,0 +1,162 @@
+use std::{fs, time::Duration};
+
+use anyhow::Result;
+use egui::{Button, CentralPanel, Checkbox, Label, ViewportBuilder, ViewportId};
+use egui_notify::{Anchor, Toast, Toasts};
+
+use crate::{
+    emulator::{EmulatorClient, EmulatorCommand, EmulatorState, SimId},
+    profiler::{Profiler, ProfilerStatus},
+    window::AppWindow,
+};
+
+pub struct ProfileWindow {
+    sim_id: SimId,
+    client: EmulatorClient,
+    profiler: Profiler,
+    toasts: Toasts,
+}
+
+impl ProfileWindow {
+    pub fn new(sim_id: SimId, client: EmulatorClient) -> Self {
+        Self {
+            sim_id,
+            client: client.clone(),
+            profiler: Profiler::new(sim_id, client),
+            toasts: Toasts::new()
+                .with_anchor(Anchor::BottomLeft)
+                .with_margin((10.0, 10.0).into())
+                .reverse(true),
+        }
+    }
+
+    pub fn launch(&mut self) {
+        self.profiler.enable();
+    }
+
+    fn finish_recording(&mut self) {
+        let pause = matches!(self.client.emulator_state(), EmulatorState::Running);
+        if pause {
+            self.client.send_command(EmulatorCommand::Pause);
+        }
+        match self.try_finish_recording() {
+            Ok(Some(path)) => {
+                let mut toast = Toast::info(format!("Saved to {path}"));
+                toast.duration(Some(Duration::from_secs(5)));
+                self.toasts.add(toast);
+            }
+            Ok(None) => {}
+            Err(error) => {
+                let mut toast = Toast::error(format!("{error:#}"));
+                toast.duration(Some(Duration::from_secs(5)));
+                self.toasts.add(toast);
+            }
+        }
+        if pause {
+            self.client.send_command(EmulatorCommand::Resume);
+        }
+    }
+
+    fn try_finish_recording(&mut self) -> Result<Option<String>> {
+        let bytes_receiver = self.profiler.finish_recording();
+        let file = rfd::FileDialog::new()
+            .add_filter("Profiler files", &["json"])
+            .set_file_name("profile.json")
+            .save_file();
+        if let Some(path) = file {
+            let bytes = pollster::block_on(bytes_receiver)?;
+            fs::write(&path, bytes)?;
+            Ok(Some(path.display().to_string()))
+        } else {
+            self.profiler.cancel_recording();
+            Ok(None)
+        }
+    }
+}
+
+impl AppWindow for ProfileWindow {
+    fn viewport_id(&self) -> ViewportId {
+        ViewportId::from_hash_of(format!("Profile-{}", self.sim_id))
+    }
+
+    fn sim_id(&self) -> SimId {
+        self.sim_id
+    }
+
+    fn initial_viewport(&self) -> ViewportBuilder {
+        ViewportBuilder::default()
+            .with_title(format!("Profiler ({})", self.sim_id))
+            .with_inner_size((300.0, 200.0))
+    }
+
+    fn show(&mut self, ctx: &egui::Context) {
+        let status = self.profiler.status();
+        let recording = matches!(status, ProfilerStatus::Recording);
+        CentralPanel::default().show(ctx, |ui| {
+            ui.horizontal_wrapped(|ui| {
+                ui.spacing_mut().item_spacing.x = 0.0;
+                ui.add(
+                    Label::new(
+                        "Use this tool to record performance profiles of your game, for use in ",
+                    )
+                    .wrap_mode(egui::TextWrapMode::Wrap),
+                );
+                ui.hyperlink("https://profiler.firefox.com");
+                ui.label(".");
+            });
+            ui.horizontal_wrapped(|ui| {
+                ui.spacing_mut().item_spacing.x = 0.0;
+                ui.add(
+                    Label::new("For more instructions, see ").wrap_mode(egui::TextWrapMode::Wrap),
+                );
+                ui.hyperlink_to(
+                    "the Lemur wiki",
+                    "https://git.virtual-boy.com/PVB/lemur/wiki/Profiling-with-Lemur",
+                );
+                ui.label(".");
+            });
+            ui.separator();
+
+            let mut enabled = status.enabled();
+            let enabled_checkbox = Checkbox::new(&mut enabled, "Enable profiling");
+            if ui.add_enabled(!recording, enabled_checkbox).changed() {
+                if enabled {
+                    self.profiler.enable();
+                } else {
+                    self.profiler.disable();
+                }
+            }
+            if !enabled {
+                ui.label("Enabling profiling will restart your current game.");
+            } else {
+                ui.horizontal(|ui| {
+                    if !recording {
+                        let record_button = Button::new("Record");
+                        let can_record = matches!(status, ProfilerStatus::Enabled);
+                        if ui.add_enabled(can_record, record_button).clicked() {
+                            self.profiler.start_recording();
+                        }
+                    } else {
+                        if ui.button("Finish recording").clicked() {
+                            self.finish_recording();
+                        }
+                        if ui.button("Cancel recording").clicked() {
+                            self.profiler.cancel_recording();
+                        }
+                    }
+                });
+            }
+
+            match &status {
+                ProfilerStatus::Recording => {
+                    ui.label("Recording...");
+                }
+                ProfilerStatus::Error(message) => {
+                    ui.label(message);
+                }
+                _ => {}
+            }
+        });
+        self.toasts.show(ctx);
+    }
+}